[botinc-agent]

Summary

@didit-protocol/auth-react-native now calls native DiditAuth instead of rejecting every call. It replaces the placeholder boundary from #62.

• JavaScript API: createDiditAuth({ publishableKey, redirectUri }) returns signIn, signInWithPasskey, registerPasskey, currentSession({ force }), getToken, signOut and stepUp({ action }). redirectUri is a required HTTPS address; native DiditAuth validates it.
• Android: the Kotlin module creates one DiditAuth(context, publishableKey, redirectUri) per application and calls its suspend methods with the foreground activity. It depends on me.didit:didit-auth.
• iOS: a Swift bridge calls the async throwing methods with the presenting view controller. It depends on DiditSDK/Auth (CocoaPods) or the DiditAuth product of sdk-ios (SwiftPM).
• Errors: native codes (cancelled, invalid_state, not_signed_in, passkey_cancelled, passkey_unavailable, browser_unavailable, rate_limited and the API's own) reach JavaScript unchanged as DiditAuthError, with status, fields and retryAfter when present. Without the native module, every call rejects with ERR_DIDIT_AUTH_UNAVAILABLE.
• Native pins: both packages pin native SDK 4.10.0, the first release with DiditAuth, so one app can link both. The source pin moves to the merged native revision. The local source build now also publishes didit-signals and didit-auth.
• The package stays private and unpublished.

Status: not ready, waiting for the native 4.10.0 release

The two native CI jobs fail on this PR and pass on main. Both build the example against released native binaries, and 4.10.0 has not been released yet:

Job	Failure	Cause
Released Android compatibility	Could not find me.didit:didit-sdk:4.10.0 and me.didit:didit-auth:4.10.0	The sdk-android Maven repository stops at 4.9.1 and has no didit-auth or didit-signals
Released iOS compatibility and bridge tests	Swift Package Manager resolves no package, so Xcode builds 1 target instead of 80; then module maps and React are missing	sdk-ios has no 4.10.0 tag

No code change can fix this: didit-auth exists in no released version, and the verification package must use the same native version as the authentication package (CocoaPods and SwiftPM resolve one DiditSDK version per app). Once sdk-android and sdk-ios carry 4.10.0, re-run both jobs on this head.

Verification

Run locally on this head; every command exited 0:

• yarn typecheck, yarn lint
• yarn test --runInBand: 17 suites, 158 tests passed
• yarn prepare, yarn build:auth, yarn workspace @didit-protocol/auth-react-native pack --dry-run
• yarn native:android with DIDIT_SDK_SOURCE_PATH at the pinned native revision: built and published didit-auth 4.10.0 and the other modules locally (JDK 17, Android SDK 36)
• In example/android, against those artifacts: ./gradlew :didit-protocol_auth-react-native:compileDebugKotlin :didit-protocol_auth-react-native:compileDebugJavaWithJavac :didit-protocol_sdk-react-native:compileDebugKotlin
• ./gradlew app:assembleDebug -PreactNativeArchitectures=arm64-v8a: BUILD SUCCESSFUL. The debug APK contains the React Native module and native DiditAuth

Not verified yet

• Builds against released artifacts: both CI jobs, after the 4.10.0 release.
• iOS: the Swift bridge has not been compiled; it needs a Mac. Run the iOS CI job after the release, or build the example with DIDIT_SDK_SOURCE_PATH set to the pinned native revision.
• Example Podfile.lock: regenerate it on macOS.
• Sign-in round trips: not exercised on a device or simulator (hosted page, passkeys, sign-out, step-up). They need an application with an HTTPS redirect, its App Link or associated domain, and the authentication service on staging.
• Release tag: the podspec's auth-react-native-v* tag is a placeholder until the package is published.

Flutter

sdk-flutter has no didit_auth package; it needs its own package and pull request in that repository. That work also needs the 4.10.0 release, and this pull request does not change Flutter.

No screens change, so there are no screenshots.

🤖 Generated with Claude Code

[arosasg]

Codex review (codex CLI, account codex-4, model gpt-5.6-sol)

---

💡 Code review

Reviewed commit: e8ba560

Select the foreground window scene before presenting

packages/auth-react-native/ios/DiditAuthBridge.swift:L103-L106 - view

When an iPad or multi-window app has multiple connected scenes, .first may select a background scene whose windows contain no key window, causing sign-in, passkey, or step-up calls to fail with browser_unavailable even though another scene is active. Filter for a foreground-active scene and obtain its key window before selecting the presenter.

Verdict: APPROVE

[arosasg]

Status after taking this over (not merged yet). The blocker in the description is gone: native 4.12.2 is released with DiditAuth (sdk-ios tag 4.12.2 with DiditAuth.xcframework.zip, sdk-android repository carries didit-auth and didit-signals 4.12.2), and the Android and Swift bridges match the current native DiditAuth API in mobile-sdks main. Pushed: merge of main (took main's release pins and dropped the temporary source pin), the auth package pinned to 4.12.2, a CONTRIBUTING note to bump both pins together, and a fix to the native Android build test that read the removed source pin. Local review verdict: APPROVE. CI on the head: lint, test, build-library and Released Android compatibility pass. Remaining red: Released iOS compatibility and bridge tests. xcodebuild stops after about 50 s with 'module map file ... DiditAuthReactNative.modulemap / SdkReactNative.modulemap not found' and 'no such module React'. The SwiftPM checksums for DiditAuth, DiditSDK and DiditSDK-Signals match the released assets, so it is not a bad release asset. Suspect: with $DiditSdkIosLinkage = 'spm' the example links both the DiditSDK product (whose module already contains the DiditAuth types) and the separate DiditAuth product, which needs a reproduction in Xcode on a Mac. Left open for that.

[arosasg]

Codex review (codex CLI, account codex-4, model gpt-5.6-sol)

---

💡 Code review

Reviewed commit: 9467bf9

Select the active window scene before presenting authentication

packages/auth-react-native/ios/DiditAuthBridge.swift:L106-L109 - view

When an iPadOS or multi-window iOS application has multiple connected scenes, the first scene is not necessarily foreground-active or the one containing the key window. Selecting .first before searching for isKeyWindow can therefore throw browser_unavailable even though another active scene can present authentication; filter for a foreground-active scene with a key window, or search all connected scenes for the key window.

Verdict: APPROVE